Bill > A1396

This bill, known as the "Reader Privacy Act," establishes rules for how "providers," which are commercial entities offering "book services" (defined as services primarily for renting, buying, borrowing, browsing, or viewing books, excluding serial publications and stores where book sales are minimal), can disclose a user's "personal information" (which includes identifying details, unique identifiers like IP addresses, and information about a user's access to the service). Generally, providers can only share this personal information with "law enforcement entities" (police officers and prosecutors) or other "government entities" if they obtain a court order. This court order requires a finding of probable cause for ongoing criminal investigations, a compelling interest, that less intrusive means are unavailable, and that the provider is given notice to contest the order. The user must also be notified of the order unless there's a judicial reason to delay notification. Disclosure is also permitted with a court order to private entities in pending legal actions, with similar requirements for compelling interest, less intrusive means, and notice to the provider, and the user has 30 days to challenge the order. Exceptions exist for informed user consent, imminent danger of death or serious physical injury where a court order is impractical, and when the information is evidence of a crime against the provider or user. Violations are punishable by civil penalties, and aggrieved users can also recover damages and attorney fees.